Module Setup & Field Guides

• Host Device: Flipper Zero
• Compatible Flipper Firmware: Official, Momentum, or Unleashed.
• Required App File: Download the latest 5ghost_wifi_lab.fap from GitHub Releases:

https://github.com/pingequalab/5ghost-wifi-lab

• Hardware Note: The PINGEQUA 5Ghost board ships preloaded. No wiring, soldering, or module flashing is required for first-time setup.
• Antenna Note: Tighten the external SMA antenna before use.
• SD Path: Copy the .fap file to /ext/apps/GPIO/ on your Flipper microSD card.
• Support Note: Built for the PINGEQUA 5Ghost BW16 board only. Other BW16 / RTL8720DN boards are not supported.

ISSUE App does not appear in Apps → GPIO.

FIX Confirm the file name is 5ghost_wifi_lab.fap and that it was copied to /ext/apps/GPIO/ on the microSD card. Reinsert the SD card or reboot the Flipper if needed.

ISSUE Board is not detected after installation.

FIX Power OFF the Flipper, remove the board, and reseat it on the top GPIO header without tilting the pins. Make sure the external antenna is tightened correctly before use. This board is designed for the PINGEQUA 5Ghost BW16 hardware only; other BW16 / RTL8720DN boards may not work correctly.

ISSUE Deauth does not work on some networks.

FIX This is usually not a hardware fault. PMF / 802.11w and WPA3-protected APs can ignore deauth by design. 5Ghost is designed to flag these protected targets instead of failing silently.

ISSUE Handshake capture is empty or inconsistent.

FIX Select a 5 GHz target AP when capturing WPA/WPA2 handshakes. On this platform, 5 GHz is the reliable capture path.

ISSUE Module firmware needs recovery or the board stops responding.

FIX Open https://flash.pingequa.com/devices/bw16-5ghost in Chrome or Edge on desktop, or Chrome on Android. Connect the board by USB-C and click Flash. If auto-entry fails, hold BOOT, tap RESET, release BOOT, and try again.

• Hardware: CC1101 Sub-GHz GPIO module with external high-gain antenna.
• Variants: Standard, and a High-Gain edition tuned for 433 MHz — nominal 20 dBm output (verified 18.6 dBm) for longer range. Setup is identical for both.
• Firmware: [CRITICAL] Unleashed (highly recommended) or other 3rd-party forks (Momentum / RogueMaster).
• Firmware link: https://github.com/DarkFlippers/unleashed-firmware
• Note: Official firmware does not support external CC1101 modules via GPIO by default. Update firmware before installing.

ISSUE "External Module Not Found" or no signal.

FIX Re-check the [Module] setting in Sub-GHz Radio Settings — it must be set to External. Ensure you are on Unleashed or compatible firmware. Check the physical connection; no bent or misaligned pins.

• Compatibility: Flipper Zero (Momentum firmware recommended).
• Critical SPI config — Path: START → PROTOCOLS → GPIO PINS. Set [NRF24 SPI] to [Extra 7] (mandatory for this module).
• Notice: Smart Auto-Switching enabled — no physical toggle needed.

ISSUE NRF24 Scanner / Jammer not working.

CAUSE These apps use hardcoded pin definitions in their current version. This is a software limitation, not a hardware defect — we are working with developers on compatibility updates.

ISSUE CC1101 "External Module Not Found".

FIX Re-check Sub-GHz settings so [External] is active. Inspect GPIO pins for alignment issues or debris.

• Hardware: ESP32-S2 Wi-Fi dev board with an 18-pin gold GPIO header (Black or Green — identical board).
• Firmware (board): ships pre-flashed with ESP32-Marauder — no flashing needed out of the box.
• Firmware (Flipper): Official, Momentum or Unleashed — all include the WiFi Marauder companion app.
• Note: the board provides the Wi-Fi radio; the Flipper runs the companion app over GPIO UART. Flipper Zero host NOT included.

ISSUE Marauder app shows no response, or the board is not detected.

FIX Re-seat the board (no bent or misaligned pins). Confirm the board has power (LED on). Update the WiFi Marauder companion app from the Flipper app catalog so its UART protocol matches the board firmware.

• Functional specs: 2.4 GHz RF transceiver (GFSK). Sniffs and injects wireless HID packets (mice / keyboards).
• Core capabilities:
• Sniffing: capture hardware addresses of unencrypted 2.4 GHz wireless devices.
• Mousejacking: inject BadUSB payloads into vulnerable wireless receivers (e.g. Logitech Unifying).
• Scanning: 2.4 GHz spectrum interference analysis.
• Required firmware: [CRITICAL] Momentum or Unleashed. Official firmware lacks the SPI drivers and GPIO apps.
• App path: Applications → GPIO → [NRF24 Sniffer / MouseJacker].

ISSUE "NRF24 Module Not Found" error.

FIX Confirm you are on third-party firmware (Official FW will not work). Check for bent pins or debris in the GPIO headers. Ensure stable 3.3V power (Pin 9).

ISSUE Sniffer captures nothing.

CAUSE Most modern "Bluetooth" mice use BLE encryption that NRF24 cannot crack; this module is effective against older 2.4 GHz GFSK protocols (early Logitech, Microsoft, non-brand wireless mice). High-traffic Wi-Fi can also drown out the sniffer.

FIX Move closer to the target receiver.

• Hardware: GPS + GLONASS module for Flipper Zero, built on the Quectel L86-M33. Receive-only — no transmitter.
• [CRITICAL] Outdoor use only: GPS cannot receive satellites indoors. Use it outside in an open area with a clear view of the sky — away from windows, walls, and metal — or you will get no fix. This is normal for any GPS receiver.
• App: Install the GPS NMEA app from the Flipper app catalog.
• App link: https://lab.flipper.net/apps/gps_nmea
• Firmware: Official or Momentum (Momentum also has a built-in GPS feature).
• Note: Uses the Flipper default GPIO pins 13/14 — no wiring changes and no pin remapping.

ISSUE No fix / no location shown.

CAUSE You are almost certainly indoors, or your view of the sky is blocked.

FIX Go outside to an open area, away from windows, walls, and metal. Give it a clear view of the sky and wait a couple of minutes.

ISSUE No data at all in the GPS NMEA app.

FIX Long-press [Up] in the app to set the baud rate to 9600, and confirm the module is seated on the default pins 13/14.

ISSUE First fix is very slow.

CAUSE A cold start with no stored data always takes longer.

FIX Stay outdoors with open sky and keep the module still. Later restarts are much faster thanks to the supercapacitor.

ISSUE Lost the fast-restart benefit after long storage.

CAUSE The supercapacitor holds for hours, not days.

FIX Do a normal first fix outdoors; restarts will be quick again afterward.

One module family, one setup. The Hydra RF 424 / 824 / 924 are the same board — only the CC1101 band tuning differs — so these steps apply to every model in the series.

• Models & bands: [424] 433 MHz · [824] 868 MHz (EU / Intl ISM) · [924] 915 MHz (US ISM).
• Compatibility: M5Stack Cardputer ADV version ONLY. Using on Cardputer v1.1 or older causes detection failure and possible firmware errors.
• Radios: CC1101 (Sub-GHz) + nRF24L01+ (2.4 GHz), with AutoBand smart switching — no physical toggle.
• Firmware: Bruce 1.14 (recommended). [NOTE] Avoid v1.15 — a known bug can reboot the Cardputer (e.g. during RF Scan); 1.14 is stable. Source: https://github.com/BruceDevices/firmware
• For one-click flashing: a desktop with Chrome or Edge + a USB-C data cable (Safari / Firefox not supported).
• Docs (pin reference, setup guide, troubleshooting): https://github.com/pingequalab/cardputer-adv-hydra-rf

ISSUE Module not found, or a config error, after flashing.

FIX Once the device reaches the Bruce main screen, click [Apply module config] on the flasher page to retry. If the SD card holds an old brucePins.conf, delete it or format the card. Last resort — set pins manually: https://github.com/pingequalab/cardputer-adv-hydra-rf

ISSUE No serial port shows in the flasher picker.

FIX Use a USB-C data cable (not charge-only) and try a different port. Flashing works only in Chrome / Edge (desktop) or Chrome (Android).

ISSUE Failed to connect, or wrong chip detected.

FIX Unplug and replug the device, then click Connect again. Close any app holding the port (Arduino IDE, serial monitor).

ISSUE RF / Sub-GHz menus show no radio.

FIX The Hydra RF module must be plugged into the Cardputer ADV — without it there is no RF hardware to drive.

ISSUE Cardputer reboots unexpectedly (e.g. during RF Scan).

CAUSE A Bruce v1.15 firmware bug — not a hardware fault.

FIX Re-flash the stable Bruce 1.14 from the one-click flasher.

ISSUE Reboot during Record Raw or high-power TX.

CAUSE The Cardputer shared SPI bus can congest under high-speed traffic — a hardware limitation, not a module defect.

FIX Remove the SD card during Record Raw, or connect external USB-C power for long sessions.

• Compatibility: M5Stack Cardputer v1.1 (Standard Edition).
• Interface: dual connection required (internal SD slot + Grove port).
• Firmware: latest Bruce (Stable or Beta).
• Physical toggle: integrated switch for mode selection (CC1101 ⇋ NRF24).
• Power: dedicated LDO + tantalum capacitors for high-power RF stability.
• Notice: always power OFF before inserting the module into the SD slot.

ISSUE "Module Not Found" or SPI errors.

FIX Re-check the physical switch position — the hardware cannot run both RF chips at once. Ensure the Grove cable is fully seated (it carries I/O the SD slot cannot). Verify the latest Bruce Beta for optimal SPI timing.

ISSUE Device reboots during high-power transmission.

CAUSE Tantalum caps buffer power, but the Cardputer's internal battery may struggle below 20%.

FIX Connect an external USB-C power source for long RF sniffing / jamming sessions.

• Host device: M5Stack Stick S3.
• Firmware: [CRITICAL] Bruce v1.14 or later (Latest / Beta).
• Flasher: https://bruce.computer/flasher
• Warning: DO NOT use v1.12 or v1.13 — only v1.14+ has the SPI & power patches required for hardware recognition. If the module is not detected, check the version first.

ISSUE "CC1101 Not Found" error.

CAUSE Typical firmware mismatch — older versions fail to power the module via SPI.

FIX Use Bruce v1.14 or a newer Beta.

ISSUE Module unresponsive or freezing.

FIX Check the Stick S3 physical power switch (side) is ON. Re-plug the module so pins are aligned and not bent. For stable RF transmission, keep battery above 30%.

• Host device: M5Stack Cardputer / M5StickC Plus 1.1 & 2.
• Firmware: [CRITICAL] latest Beta from https://bruce.computer/flasher
• Firmware alert: DO NOT use v1.13 / v1.14 Stable — these have SPI bus timing issues on M5StickC / Cardputer hardware. The Beta includes AXP2101 power-management patches for 100% recognition.
• In the box: RF board, microSD interface, Grove cable.

ISSUE "Module Not Found" error.

FIX Re-verify you are on the latest Beta firmware. Ensure the Grove cable is firmly seated and the physical switch is in the correct position.

ISSUE Limited NRF24 jammer range.

CAUSE Low-power hardware design and 2.4 GHz anti-interference naturally limit range — a design characteristic, not a defect.

FIX For advanced config see https://github.com/pr3y/Bruce/wiki